@substrat-run/kernel 0.141.0 → 0.143.0

package/dist/row-decode.d.ts

@@ -19,7 +19,8 @@ import { type Actor, type PermissionKey } from '@substrat-run/contracts';
  * - a REQUIRED scalar has no honest empty value, so a row that breaks one cannot be the
  *   contract shape without lying. It is collected, and `finish` throws naming every
  *   column the row broke — the strict decode this replaced, kept for exactly the part it
- *   cannot honestly relax.
+ *   cannot honestly relax. A read whose contract has a variant for such a row (the intent
+ *   journal's, #1637) uses `finishOr` and returns that instead.
  *
  * **Every value a decoder built on this returns satisfies the published schema**, which
  * is #1634's review finding carried forward: a field is only ever replaced by a value its
@@ -66,6 +67,12 @@ export declare const UNDECODED_ACTOR: Actor;
  * `decodeError`, beside this self-naming marker.
  */
 export declare const UNDECODED_PERMISSION: PermissionKey;
+/**
+ * Stored text cut to {@link QUOTED_MAX}, with `…` where it was cut — for any decoder that hands a
+ * stored value back verbatim (#1637), so an oversized one cannot ride into a report, a log line
+ * that repeats every tick, or a screen.
+ */
+export declare function capped(text: string): string;
 /** `column: message`, for the first issue a field's schema raised. */
 export declare function issueOf(column: string, error: Extract<FieldParse<unknown>, {
     success: false;
@@ -95,6 +102,14 @@ export interface RowDecoder {
     finish<R extends object>(decoded: R): R & {
         decodeError?: string;
     };
+    /**
+     * `finish`, for a read that has a variant to return instead of throwing (#1637): when a
+     * required scalar broke, `unreadable` is handed the same message `finish` would throw — every
+     * column named — and its result is returned in place of the row.
+     */
+    finishOr<R extends object, V>(decoded: R, unreadable: (decodeError: string) => V): (R & {
+        decodeError?: string;
+    }) | V;
 }
 /**
  * One row's decoder. `subject` names the row in a throw (`platform request row "01J…"`),

package/dist/row-decode.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"row-decode.d.ts","sourceRoot":"","sources":["../src/row-decode.ts"],"names":[],"mappings":"AAAA,OAAO,EAAwB,KAAK,KAAK,EAAE,KAAK,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAE/F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,KAAK,UAAU,CAAC,CAAC,IACb;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,CAAC,CAAA;CAAE,GAC1B;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE;QAAE,MAAM,EAAE,aAAa,CAAC;YAAE,OAAO,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,aAAa,CAAC,WAAW,CAAC,CAAA;SAAE,CAAC,CAAA;KAAE,CAAA;CAAE,CAAC;AAEhH,oFAAoF;AACpF,MAAM,WAAW,KAAK,CAAC,CAAC;IACtB,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;CAC1C;AAED;;;;GAIG;AACH,eAAO,MAAM,eAAe,EAAE,KAA8C,CAAC;AAE7E;;;;;;;;;GASG;AACH,eAAO,MAAM,oBAAoB,EAAE,aAA6D,CAAC;AAKjG,sEAAsE;AACtE,wBAAgB,OAAO,CACrB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE;IAAE,OAAO,EAAE,KAAK,CAAA;CAAE,CAAC,CAAC,OAAO,CAAC,GAC/D,MAAM,CAIR;AAED,8FAA8F;AAC9F,eAAO,MAAM,QAAQ,mBAAmB,CAAC;AAEzC,MAAM,WAAW,UAAU;IACzB,mGAAmG;IACnG,QAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,GAAG,CAAC,CAAC;IACjE,oFAAoF;IACpF,QAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC;IAC/E;;;;;OAKG;IACH,MAAM,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC;IAC1E,mGAAmG;IACnG,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC;IAC7E,8FAA8F;IAC9F,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACrC;;;OAGG;IACH,MAAM,CAAC,CAAC,SAAS,MAAM,EAAE,OAAO,EAAE,CAAC,GAAG,CAAC,GAAG;QAAE,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACpE;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,UAAU,CAwDxE"}
+{"version":3,"file":"row-decode.d.ts","sourceRoot":"","sources":["../src/row-decode.ts"],"names":[],"mappings":"AAAA,OAAO,EAAwB,KAAK,KAAK,EAAE,KAAK,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAE/F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,KAAK,UAAU,CAAC,CAAC,IACb;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,CAAC,CAAA;CAAE,GAC1B;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE;QAAE,MAAM,EAAE,aAAa,CAAC;YAAE,OAAO,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,aAAa,CAAC,WAAW,CAAC,CAAA;SAAE,CAAC,CAAA;KAAE,CAAA;CAAE,CAAC;AAEhH,oFAAoF;AACpF,MAAM,WAAW,KAAK,CAAC,CAAC;IACtB,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;CAC1C;AAED;;;;GAIG;AACH,eAAO,MAAM,eAAe,EAAE,KAA8C,CAAC;AAE7E;;;;;;;;;GASG;AACH,eAAO,MAAM,oBAAoB,EAAE,aAA6D,CAAC;AAKjG;;;;GAIG;AACH,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE3C;AAED,sEAAsE;AACtE,wBAAgB,OAAO,CACrB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE;IAAE,OAAO,EAAE,KAAK,CAAA;CAAE,CAAC,CAAC,OAAO,CAAC,GAC/D,MAAM,CAIR;AAED,8FAA8F;AAC9F,eAAO,MAAM,QAAQ,mBAAmB,CAAC;AAEzC,MAAM,WAAW,UAAU;IACzB,mGAAmG;IACnG,QAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,GAAG,CAAC,CAAC;IACjE,oFAAoF;IACpF,QAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC;IAC/E;;;;;OAKG;IACH,MAAM,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC;IAC1E,mGAAmG;IACnG,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC;IAC7E,8FAA8F;IAC9F,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACrC;;;OAGG;IACH,MAAM,CAAC,CAAC,SAAS,MAAM,EAAE,OAAO,EAAE,CAAC,GAAG,CAAC,GAAG;QAAE,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACnE;;;;OAIG;IACH,QAAQ,CAAC,CAAC,SAAS,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG;QAAE,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,CAAC,CAAC;CACvH;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,UAAU,CA0DxE"}

package/dist/row-decode.js

@@ -18,6 +18,14 @@ export const UNDECODED_ACTOR = actor.parse({ system: 'undecodable' });
 export const UNDECODED_PERMISSION = permissionKey.parse('undecodable:permission');
 /** How much of a stored scalar a `marked` field quotes back — a key, not a payload. */
 const QUOTED_MAX = 200;
+/**
+ * Stored text cut to {@link QUOTED_MAX}, with `…` where it was cut — for any decoder that hands a
+ * stored value back verbatim (#1637), so an oversized one cannot ride into a report, a log line
+ * that repeats every tick, or a screen.
+ */
+export function capped(text) {
+    return text.length > QUOTED_MAX ? `${text.slice(0, QUOTED_MAX)}…` : text;
+}
 /** `column: message`, for the first issue a field's schema raised. */
 export function issueOf(column, error) {
     const issue = error.issues[0];
@@ -36,6 +44,11 @@ export function rowDecoder(subject, contract) {
     const undecoded = [];
     const unreadable = [];
     const failed = new Set();
+    const finishOr = (decoded, onUnreadable) => {
+        if (unreadable.length)
+            return onUnreadable([...unreadable, ...undecoded].join('; '));
+        return undecoded.length ? { ...decoded, decodeError: undecoded.join('; ') } : decoded;
+    };
     return {
         failed,
         required(column, field, stored) {
@@ -58,8 +71,7 @@ export function rowDecoder(subject, contract) {
             const r = field.safeParse(stored);
             if (r.success)
                 return r.data;
-            const quoted = JSON.stringify(stored) ?? String(stored);
-            undecoded.push(`${issueOf(column, r.error)} (stored ${quoted.length > QUOTED_MAX ? `${quoted.slice(0, QUOTED_MAX)}…` : quoted})`);
+            undecoded.push(`${issueOf(column, r.error)} (stored ${capped(JSON.stringify(stored) ?? String(stored))})`);
             failed.add(column);
             return marker;
         },
@@ -83,11 +95,11 @@ export function rowDecoder(subject, contract) {
             return empty;
         },
         finish(decoded) {
-            if (unreadable.length) {
-                throw new Error(`${subject} cannot be read as a ${contract} — ${[...unreadable, ...undecoded].join('; ')}`);
-            }
-            return undecoded.length ? { ...decoded, decodeError: undecoded.join('; ') } : decoded;
+            return finishOr(decoded, (why) => {
+                throw new Error(`${subject} cannot be read as a ${contract} — ${why}`);
+            });
         },
+        finishOr,
     };
 }
 //# sourceMappingURL=row-decode.js.map

package/dist/row-decode.js.map

@@ -1 +1 @@
-{"version":3,"file":"row-decode.js","sourceRoot":"","sources":["../src/row-decode.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,aAAa,EAAkC,MAAM,yBAAyB,CAAC;AA8C/F;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAU,KAAK,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;AAE7E;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAkB,aAAa,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;AAEjG,uFAAuF;AACvF,MAAM,UAAU,GAAG,GAAG,CAAC;AAEvB,sEAAsE;AACtE,MAAM,UAAU,OAAO,CACrB,MAAc,EACd,KAAgE;IAEhE,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC9B,MAAM,EAAE,GAAG,KAAK,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACpF,OAAO,GAAG,MAAM,GAAG,EAAE,KAAK,KAAK,EAAE,OAAO,IAAI,6BAA6B,EAAE,CAAC;AAC9E,CAAC;AAED,8FAA8F;AAC9F,MAAM,CAAC,MAAM,QAAQ,GAAG,gBAAgB,CAAC;AAyBzC;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,OAAe,EAAE,QAAgB;IAC1D,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,OAAO;QACL,MAAM;QACN,QAAQ,CAAI,MAAc,EAAE,KAAe,EAAE,MAAe;YAC1D,MAAM,CAAC,GAAG,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAClC,IAAI,CAAC,CAAC,OAAO;gBAAE,OAAO,CAAC,CAAC,IAAI,CAAC;YAC7B,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;YAC1C,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACnB,OAAO,SAAkB,CAAC;QAC5B,CAAC;QACD,QAAQ,CAAI,MAAc,EAAE,KAAsB,EAAE,MAAe;YACjE,MAAM,CAAC,GAAG,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAClC,IAAI,CAAC,CAAC,OAAO;gBAAE,OAAO,CAAC,CAAC,IAAI,CAAC;YAC7B,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;YACzC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACnB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,CAAI,MAAc,EAAE,KAAe,EAAE,MAAe,EAAE,MAAS;YACnE,MAAM,CAAC,GAAG,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAClC,IAAI,CAAC,CAAC,OAAO;gBAAE,OAAO,CAAC,CAAC,IAAI,CAAC;YAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;YACxD,SAAS,CAAC,IAAI,CACZ,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY,MAAM,CAAC,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,GAAG,CAClH,CAAC;YACF,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACnB,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,IAAI,CAAI,MAAc,EAAE,KAAe,EAAE,MAAqB,EAAE,KAAQ;YACtE,IAAI,KAAK,GAAY,IAAI,CAAC;YAC1B,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;gBACpB,IAAI,CAAC;oBACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBAC7B,CAAC;gBAAC,MAAM,CAAC;oBACP,SAAS,CAAC,IAAI,CAAC,GAAG,MAAM,KAAK,QAAQ,EAAE,CAAC,CAAC;oBACzC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;oBACnB,OAAO,KAAK,CAAC;gBACf,CAAC;YACH,CAAC;YACD,MAAM,CAAC,GAAG,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YACjC,IAAI,CAAC,CAAC,OAAO;gBAAE,OAAO,CAAC,CAAC,IAAI,CAAC;YAC7B,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;YACzC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACnB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,CAAmB,OAAU;YACjC,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC;gBACtB,MAAM,IAAI,KAAK,CACb,GAAG,OAAO,wBAAwB,QAAQ,MAAM,CAAC,GAAG,UAAU,EAAE,GAAG,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC3F,CAAC;YACJ,CAAC;YACD,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,WAAW,EAAE,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;QACxF,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"row-decode.js","sourceRoot":"","sources":["../src/row-decode.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,aAAa,EAAkC,MAAM,yBAAyB,CAAC;AA+C/F;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAU,KAAK,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;AAE7E;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAkB,aAAa,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;AAEjG,uFAAuF;AACvF,MAAM,UAAU,GAAG,GAAG,CAAC;AAEvB;;;;GAIG;AACH,MAAM,UAAU,MAAM,CAAC,IAAY;IACjC,OAAO,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AAC3E,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,OAAO,CACrB,MAAc,EACd,KAAgE;IAEhE,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC9B,MAAM,EAAE,GAAG,KAAK,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACpF,OAAO,GAAG,MAAM,GAAG,EAAE,KAAK,KAAK,EAAE,OAAO,IAAI,6BAA6B,EAAE,CAAC;AAC9E,CAAC;AAED,8FAA8F;AAC9F,MAAM,CAAC,MAAM,QAAQ,GAAG,gBAAgB,CAAC;AA+BzC;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,OAAe,EAAE,QAAgB;IAC1D,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,MAAM,QAAQ,GAAG,CACf,OAAU,EACV,YAAwC,EACJ,EAAE;QACtC,IAAI,UAAU,CAAC,MAAM;YAAE,OAAO,YAAY,CAAC,CAAC,GAAG,UAAU,EAAE,GAAG,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACrF,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,WAAW,EAAE,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;IACxF,CAAC,CAAC;IACF,OAAO;QACL,MAAM;QACN,QAAQ,CAAI,MAAc,EAAE,KAAe,EAAE,MAAe;YAC1D,MAAM,CAAC,GAAG,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAClC,IAAI,CAAC,CAAC,OAAO;gBAAE,OAAO,CAAC,CAAC,IAAI,CAAC;YAC7B,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;YAC1C,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACnB,OAAO,SAAkB,CAAC;QAC5B,CAAC;QACD,QAAQ,CAAI,MAAc,EAAE,KAAsB,EAAE,MAAe;YACjE,MAAM,CAAC,GAAG,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAClC,IAAI,CAAC,CAAC,OAAO;gBAAE,OAAO,CAAC,CAAC,IAAI,CAAC;YAC7B,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;YACzC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACnB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,CAAI,MAAc,EAAE,KAAe,EAAE,MAAe,EAAE,MAAS;YACnE,MAAM,CAAC,GAAG,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAClC,IAAI,CAAC,CAAC,OAAO;gBAAE,OAAO,CAAC,CAAC,IAAI,CAAC;YAC7B,SAAS,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC;YAC3G,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACnB,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,IAAI,CAAI,MAAc,EAAE,KAAe,EAAE,MAAqB,EAAE,KAAQ;YACtE,IAAI,KAAK,GAAY,IAAI,CAAC;YAC1B,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;gBACpB,IAAI,CAAC;oBACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBAC7B,CAAC;gBAAC,MAAM,CAAC;oBACP,SAAS,CAAC,IAAI,CAAC,GAAG,MAAM,KAAK,QAAQ,EAAE,CAAC,CAAC;oBACzC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;oBACnB,OAAO,KAAK,CAAC;gBACf,CAAC;YACH,CAAC;YACD,MAAM,CAAC,GAAG,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YACjC,IAAI,CAAC,CAAC,OAAO;gBAAE,OAAO,CAAC,CAAC,IAAI,CAAC;YAC7B,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;YACzC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACnB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,CAAmB,OAAU;YACjC,OAAO,QAAQ,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBAC/B,MAAM,IAAI,KAAK,CAAC,GAAG,OAAO,wBAAwB,QAAQ,MAAM,GAAG,EAAE,CAAC,CAAC;YACzE,CAAC,CAAC,CAAC;QACL,CAAC;QACD,QAAQ;KACT,CAAC;AACJ,CAAC"}

package/dist/scope-copy-ledger.d.ts

@@ -34,6 +34,55 @@ export declare const copyMoveConfirmParams: (confirm: ScopeCopyMoveConfirmation,
 export declare const COPY_EXPIRED_SQL = "\n  SELECT tenant_id, scope_id, script_ref, move_id FROM scope_script_copies\n  WHERE state = 'pending' AND (lease_until IS NULL OR lease_until <= ?)\n  ORDER BY lease_until, tenant_id, scope_id, script_ref, move_id LIMIT ?";
 /** Claim one expired entry, re-checked in the write. Params: owner, leaseUntil, the key, now. */
 export declare const COPY_CLAIM_SQL = "\n  UPDATE scope_script_copies SET lease_owner = ?, lease_until = ?\n  WHERE tenant_id = ? AND scope_id = ? AND script_ref = ? AND move_id = ?\n    AND state = 'pending' AND (lease_until IS NULL OR lease_until <= ?)";
+/** The move id every backfilled entry carries (#1722), which names it as one in a listing. */
+export declare const BACKFILL_MOVE_ID = "backfill:1722";
+/**
+ * Record a copy made before the ledger existed, as `retained` (#1722). Never pending, so no move's
+ * confirmation and no lease sweep ever acts on it; never `eligible`, because a historic copy has
+ * no recorded load stamp for a fenced wipe to compare. Refused under a reap claim, like any new
+ * entry, and skipped when the ledger already names the script for this scope in any state: from
+ * that entry on the ledger tracks that store, historic data in it included.
+ * Params: `copyBackfillParams`.
+ */
+export declare const COPY_BACKFILL_SQL = "\n  INSERT INTO scope_script_copies (tenant_id, scope_id, script_ref, move_id, state, last_attempt_at)\n  SELECT tenant_id, scope_id, ?, ?, 'retained', strftime('%Y-%m-%dT%H:%M:%fZ','now') FROM scopes\n  WHERE tenant_id = ? AND scope_id = ? AND reap_claimed_at IS NULL\n    AND NOT EXISTS (SELECT 1 FROM scope_script_copies AS copy\n      WHERE copy.tenant_id = scopes.tenant_id AND copy.scope_id = scopes.scope_id AND copy.script_ref = ?)";
+export declare const copyBackfillParams: (tenantId: string, scopeId: string, scriptRef: string) => string[];
+/** What a backfill insert did: wrote the entry, found the script already ledgered, or was refused. */
+export type ScopeCopyBackfillResult = 'recorded' | 'ledgered' | 'reaping' | 'missing';
+/**
+ * Settle the scope's backfilled entries a tracked entry has taken over (#1722, review r1). The
+ * backfill records a script only while no move names it; once a move's own entry for the same
+ * script is `done`, that store was wiped under the move's fence or is the scope's route, so the
+ * historic data the backfilled entry stood for is gone or reached. Leaving the entry `retained`
+ * would send every later reap and erasure to a store that refuses writes behind its tombstone.
+ * Run in the same transaction as every write that settles an entry `done`: a settle and a
+ * confirming bind, on both adapters. Params: tenantId, scopeId.
+ */
+export declare const COPY_BACKFILL_SUPERSEDE_SQL = "\n  UPDATE scope_script_copies SET state = 'done', last_attempt_at = strftime('%Y-%m-%dT%H:%M:%fZ','now')\n  WHERE tenant_id = ? AND scope_id = ? AND move_id = 'backfill:1722' AND state <> 'done'\n    AND EXISTS (SELECT 1 FROM scope_script_copies AS tracked\n      WHERE tracked.tenant_id = scope_script_copies.tenant_id AND tracked.scope_id = scope_script_copies.scope_id\n        AND tracked.script_ref = scope_script_copies.script_ref AND tracked.move_id <> 'backfill:1722'\n        AND tracked.state = 'done')";
+/**
+ * The scope row read in the backfill insert's own transaction: what explains an insert that wrote
+ * nothing, and the erasure epoch a recorded entry was written under. An erasure claimed before the
+ * insert moved the epoch past what it compared (its `shredSubject` row's `before`), so a subject
+ * whose erasure's epoch is below this one never reached the recorded copy, whatever order their
+ * audit rows landed in. Params: tenantId, scopeId.
+ */
+export declare const COPY_BACKFILL_SCOPE_SQL = "SELECT reap_claimed_at, COALESCE(erasure_epoch, 0) AS erasure_epoch FROM scopes WHERE tenant_id = ? AND scope_id = ?";
+/**
+ * What an erasure's `shredSubject` row records in `before` (#1722): the erasure epoch it ran under
+ * and how it ran. `orchestrated` claimed the scope's copy inventory at that epoch and redacted every
+ * copy in it; `direct` took no claim and redacted only the scope's own store, so it never reaches a
+ * script copy whatever its epoch. The backfill orders erasures against the copies it records by it.
+ */
+export interface ErasureEpochStamp {
+    erasureEpoch: number;
+    path: 'orchestrated' | 'direct';
+}
+/** `COPY_BACKFILL_SCOPE_SQL`'s row. */
+export interface CopyBackfillScopeRow {
+    reap_claimed_at: string | null;
+    erasure_epoch: number;
+}
+/** Read the outcome of a backfill insert that wrote nothing, from `COPY_BACKFILL_SCOPE_SQL`'s row. */
+export declare const copyBackfillRefusal: (scope: CopyBackfillScopeRow | undefined) => ScopeCopyBackfillResult;
 /**
  * The fence a copy move's restore carries into the destination's own store (#1722). The vertical
  * that holds the destination has no reach to the directory, so the move's lease travels with
@@ -53,8 +102,6 @@ export interface CopyRestoreFence {
     notAfter: string;
     erasureEpoch: number;
 }
-/** How far inside the lease a restore must commit: five minutes, or a quarter of a short lease. */
-export declare const copyRestoreFenceMarginMs: (leaseMs: number) => number;
 /** The fence for a move whose entries were recorded no earlier than `recordedAt` (epoch ms). */
 export declare const copyRestoreFence: (moveId: string, recordedAt: number, leaseMs: number, erasureEpoch: number) => CopyRestoreFence;
 /** Whether a restore carrying `fence` may no longer land at `now` (epoch ms). */

package/dist/scope-copy-ledger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scope-copy-ledger.d.ts","sourceRoot":"","sources":["../src/scope-copy-ledger.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,yBAAyB,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAElF;;;;;;;;;;;;;;;;;GAiBG;AAEH,8FAA8F;AAC9F,eAAO,MAAM,wBAAwB,4cAM0B,CAAC;AAEhE,eAAO,MAAM,kBAAkB,YAAa,yBAAyB,OAAO,MAAM,KAAG,MAAM,EACpD,CAAC;AAExC;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB,kWAM2C,CAAC;AAE9E,eAAO,MAAM,qBAAqB,YACvB,yBAAyB,YAAY,MAAM,WAAW,MAAM,OAAO,MAAM,KACjF,CAAC,MAAM,GAAG,IAAI,CAAC,EAGjB,CAAC;AAEF,uGAAuG;AACvG,eAAO,MAAM,gBAAgB,oOAG4C,CAAC;AAE1E,iGAAiG;AACjG,eAAO,MAAM,cAAc,4NAG6C,CAAC;AAEzE;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,mGAAmG;AACnG,eAAO,MAAM,wBAAwB,YAAa,MAAM,KAAG,MAAuD,CAAC;AAEnH,gGAAgG;AAChG,eAAO,MAAM,gBAAgB,WACnB,MAAM,cAAc,MAAM,WAAW,MAAM,gBAAgB,MAAM,KACxE,gBAID,CAAC;AAEH,iFAAiF;AACjF,eAAO,MAAM,sBAAsB,UAAW,gBAAgB,OAAO,MAAM,KAAG,OAA2C,CAAC;AAE1H,6EAA6E;AAC7E,eAAO,MAAM,yBAAyB,iFAAiF,CAAC;AAExH,6CAA6C;AAC7C,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,wFAAwF;AACxF,eAAO,MAAM,yBAAyB,6FACsD,CAAC;AAE7F,eAAO,MAAM,iBAAiB,MAAO,kBAAkB,KAAG,eAUxD,CAAC"}
+{"version":3,"file":"scope-copy-ledger.d.ts","sourceRoot":"","sources":["../src/scope-copy-ledger.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,yBAAyB,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAElF;;;;;;;;;;;;;;;;;GAiBG;AAEH,8FAA8F;AAC9F,eAAO,MAAM,wBAAwB,4cAM0B,CAAC;AAEhE,eAAO,MAAM,kBAAkB,YAAa,yBAAyB,OAAO,MAAM,KAAG,MAAM,EACpD,CAAC;AAExC;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB,kWAM2C,CAAC;AAE9E,eAAO,MAAM,qBAAqB,YACvB,yBAAyB,YAAY,MAAM,WAAW,MAAM,OAAO,MAAM,KACjF,CAAC,MAAM,GAAG,IAAI,CAAC,EAGjB,CAAC;AAEF,uGAAuG;AACvG,eAAO,MAAM,gBAAgB,oOAG4C,CAAC;AAE1E,iGAAiG;AACjG,eAAO,MAAM,cAAc,4NAG6C,CAAC;AAEzE,8FAA8F;AAC9F,eAAO,MAAM,gBAAgB,kBAAkB,CAAC;AAEhD;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,4bAK6E,CAAC;AAE5G,eAAO,MAAM,kBAAkB,aAAc,MAAM,WAAW,MAAM,aAAa,MAAM,KAAG,MAAM,EACnC,CAAC;AAE9D,sGAAsG;AACtG,MAAM,MAAM,uBAAuB,GAAG,UAAU,GAAG,UAAU,GAAG,SAAS,GAAG,SAAS,CAAC;AAEtF;;;;;;;;GAQG;AACH,eAAO,MAAM,2BAA2B,sgBAMJ,CAAC;AAErC;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,yHACoF,CAAC;AAEzH;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAAG,YAAY,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,cAAc,GAAG,QAAQ,CAAA;CAAE;AAE5F,uCAAuC;AACvC,MAAM,WAAW,oBAAoB;IAAG,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE;AAE/F,sGAAsG;AACtG,eAAO,MAAM,mBAAmB,UAAW,oBAAoB,GAAG,SAAS,KAAG,uBACA,CAAC;AAE/E;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;CACtB;AAKD,gGAAgG;AAChG,eAAO,MAAM,gBAAgB,WACnB,MAAM,cAAc,MAAM,WAAW,MAAM,gBAAgB,MAAM,KACxE,gBAID,CAAC;AAEH,iFAAiF;AACjF,eAAO,MAAM,sBAAsB,UAAW,gBAAgB,OAAO,MAAM,KAAG,OAA2C,CAAC;AAE1H,6EAA6E;AAC7E,eAAO,MAAM,yBAAyB,iFAAiF,CAAC;AAExH,6CAA6C;AAC7C,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,wFAAwF;AACxF,eAAO,MAAM,yBAAyB,6FACsD,CAAC;AAE7F,eAAO,MAAM,iBAAiB,MAAO,kBAAkB,KAAG,eAUxD,CAAC"}

package/dist/scope-copy-ledger.js

@@ -54,8 +54,51 @@ export const COPY_CLAIM_SQL = `
   UPDATE scope_script_copies SET lease_owner = ?, lease_until = ?
   WHERE tenant_id = ? AND scope_id = ? AND script_ref = ? AND move_id = ?
     AND state = 'pending' AND (lease_until IS NULL OR lease_until <= ?)`;
+/** The move id every backfilled entry carries (#1722), which names it as one in a listing. */
+export const BACKFILL_MOVE_ID = 'backfill:1722';
+/**
+ * Record a copy made before the ledger existed, as `retained` (#1722). Never pending, so no move's
+ * confirmation and no lease sweep ever acts on it; never `eligible`, because a historic copy has
+ * no recorded load stamp for a fenced wipe to compare. Refused under a reap claim, like any new
+ * entry, and skipped when the ledger already names the script for this scope in any state: from
+ * that entry on the ledger tracks that store, historic data in it included.
+ * Params: `copyBackfillParams`.
+ */
+export const COPY_BACKFILL_SQL = `
+  INSERT INTO scope_script_copies (tenant_id, scope_id, script_ref, move_id, state, last_attempt_at)
+  SELECT tenant_id, scope_id, ?, ?, 'retained', strftime('%Y-%m-%dT%H:%M:%fZ','now') FROM scopes
+  WHERE tenant_id = ? AND scope_id = ? AND reap_claimed_at IS NULL
+    AND NOT EXISTS (SELECT 1 FROM scope_script_copies AS copy
+      WHERE copy.tenant_id = scopes.tenant_id AND copy.scope_id = scopes.scope_id AND copy.script_ref = ?)`;
+export const copyBackfillParams = (tenantId, scopeId, scriptRef) => [scriptRef, BACKFILL_MOVE_ID, tenantId, scopeId, scriptRef];
+/**
+ * Settle the scope's backfilled entries a tracked entry has taken over (#1722, review r1). The
+ * backfill records a script only while no move names it; once a move's own entry for the same
+ * script is `done`, that store was wiped under the move's fence or is the scope's route, so the
+ * historic data the backfilled entry stood for is gone or reached. Leaving the entry `retained`
+ * would send every later reap and erasure to a store that refuses writes behind its tombstone.
+ * Run in the same transaction as every write that settles an entry `done`: a settle and a
+ * confirming bind, on both adapters. Params: tenantId, scopeId.
+ */
+export const COPY_BACKFILL_SUPERSEDE_SQL = `
+  UPDATE scope_script_copies SET state = 'done', last_attempt_at = strftime('%Y-%m-%dT%H:%M:%fZ','now')
+  WHERE tenant_id = ? AND scope_id = ? AND move_id = '${BACKFILL_MOVE_ID}' AND state <> 'done'
+    AND EXISTS (SELECT 1 FROM scope_script_copies AS tracked
+      WHERE tracked.tenant_id = scope_script_copies.tenant_id AND tracked.scope_id = scope_script_copies.scope_id
+        AND tracked.script_ref = scope_script_copies.script_ref AND tracked.move_id <> '${BACKFILL_MOVE_ID}'
+        AND tracked.state = 'done')`;
+/**
+ * The scope row read in the backfill insert's own transaction: what explains an insert that wrote
+ * nothing, and the erasure epoch a recorded entry was written under. An erasure claimed before the
+ * insert moved the epoch past what it compared (its `shredSubject` row's `before`), so a subject
+ * whose erasure's epoch is below this one never reached the recorded copy, whatever order their
+ * audit rows landed in. Params: tenantId, scopeId.
+ */
+export const COPY_BACKFILL_SCOPE_SQL = 'SELECT reap_claimed_at, COALESCE(erasure_epoch, 0) AS erasure_epoch FROM scopes WHERE tenant_id = ? AND scope_id = ?';
+/** Read the outcome of a backfill insert that wrote nothing, from `COPY_BACKFILL_SCOPE_SQL`'s row. */
+export const copyBackfillRefusal = (scope) => !scope ? 'missing' : scope.reap_claimed_at !== null ? 'reaping' : 'ledgered';
 /** How far inside the lease a restore must commit: five minutes, or a quarter of a short lease. */
-export const copyRestoreFenceMarginMs = (leaseMs) => Math.min(5 * 60_000, Math.floor(leaseMs / 4));
+const copyRestoreFenceMarginMs = (leaseMs) => Math.min(5 * 60_000, Math.floor(leaseMs / 4));
 /** The fence for a move whose entries were recorded no earlier than `recordedAt` (epoch ms). */
 export const copyRestoreFence = (moveId, recordedAt, leaseMs, erasureEpoch) => ({
     moveId,

package/dist/scope-copy-ledger.js.map

@@ -1 +1 @@
-{"version":3,"file":"scope-copy-ledger.js","sourceRoot":"","sources":["../src/scope-copy-ledger.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;GAiBG;AAEH,8FAA8F;AAC9F,MAAM,CAAC,MAAM,wBAAwB,GAAG;;;;;;+DAMuB,CAAC;AAEhE,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,OAAkC,EAAE,GAAW,EAAY,EAAE,CAC9F,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AAExC;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG;;;;;;6EAMwC,CAAC;AAE9E,MAAM,CAAC,MAAM,qBAAqB,GAAG,CACnC,OAAkC,EAAE,QAAgB,EAAE,OAAe,EAAE,GAAW,EAC/D,EAAE,CAAC;IACtB,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,YAAY,EAAE,SAAS,IAAI,IAAI,EAAE,OAAO,CAAC,YAAY,EAAE,QAAQ,IAAI,IAAI;IAC/F,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM;CACvC,CAAC;AAEF,uGAAuG;AACvG,MAAM,CAAC,MAAM,gBAAgB,GAAG;;;yEAGyC,CAAC;AAE1E,iGAAiG;AACjG,MAAM,CAAC,MAAM,cAAc,GAAG;;;wEAG0C,CAAC;AAsBzE,mGAAmG;AACnG,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,OAAe,EAAU,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;AAEnH,gGAAgG;AAChG,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAC9B,MAAc,EAAE,UAAkB,EAAE,OAAe,EAAE,YAAoB,EACvD,EAAE,CAAC,CAAC;IACtB,MAAM;IACN,QAAQ,EAAE,IAAI,IAAI,CAAC,UAAU,GAAG,OAAO,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,EAAE;IAC1F,YAAY;CACb,CAAC,CAAC;AAEH,iFAAiF;AACjF,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,KAAuB,EAAE,GAAW,EAAW,EAAE,CAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;AAE1H,6EAA6E;AAC7E,MAAM,CAAC,MAAM,yBAAyB,GAAG,8EAA8E,CAAC;AAexH,wFAAwF;AACxF,MAAM,CAAC,MAAM,yBAAyB,GACpC,0FAA0F,CAAC;AAE7F,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAqB,EAAmB,EAAE,CAAC,CAAC;IAC5E,QAAQ,EAAE,CAAC,CAAC,SAAqB;IACjC,OAAO,EAAE,CAAC,CAAC,QAAmB;IAC9B,SAAS,EAAE,CAAC,CAAC,UAAU;IACvB,MAAM,EAAE,CAAC,CAAC,OAAO;IACjB,KAAK,EAAE,CAAC,CAAC,KAAiC;IAC1C,SAAS,EAAE,CAAC,CAAC,UAAU;IACvB,QAAQ,EAAE,CAAC,CAAC,QAAQ;IACpB,IAAI,EAAE,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;IACrE,UAAU,EAAE,CAAC,CAAC,WAAW;CAC1B,CAAC,CAAC"}
+{"version":3,"file":"scope-copy-ledger.js","sourceRoot":"","sources":["../src/scope-copy-ledger.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;GAiBG;AAEH,8FAA8F;AAC9F,MAAM,CAAC,MAAM,wBAAwB,GAAG;;;;;;+DAMuB,CAAC;AAEhE,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,OAAkC,EAAE,GAAW,EAAY,EAAE,CAC9F,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AAExC;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG;;;;;;6EAMwC,CAAC;AAE9E,MAAM,CAAC,MAAM,qBAAqB,GAAG,CACnC,OAAkC,EAAE,QAAgB,EAAE,OAAe,EAAE,GAAW,EAC/D,EAAE,CAAC;IACtB,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,YAAY,EAAE,SAAS,IAAI,IAAI,EAAE,OAAO,CAAC,YAAY,EAAE,QAAQ,IAAI,IAAI;IAC/F,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM;CACvC,CAAC;AAEF,uGAAuG;AACvG,MAAM,CAAC,MAAM,gBAAgB,GAAG;;;yEAGyC,CAAC;AAE1E,iGAAiG;AACjG,MAAM,CAAC,MAAM,cAAc,GAAG;;;wEAG0C,CAAC;AAEzE,8FAA8F;AAC9F,MAAM,CAAC,MAAM,gBAAgB,GAAG,eAAe,CAAC;AAEhD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG;;;;;2GAK0E,CAAC;AAE5G,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,QAAgB,EAAE,OAAe,EAAE,SAAiB,EAAY,EAAE,CACnG,CAAC,SAAS,EAAE,gBAAgB,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;AAK9D;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG;;wDAEa,gBAAgB;;;0FAGkB,gBAAgB;oCACtE,CAAC;AAErC;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAClC,sHAAsH,CAAC;AAazH,sGAAsG;AACtG,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,KAAuC,EAA2B,EAAE,CACtG,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,eAAe,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC;AAsB/E,mGAAmG;AACnG,MAAM,wBAAwB,GAAG,CAAC,OAAe,EAAU,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;AAE5G,gGAAgG;AAChG,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAC9B,MAAc,EAAE,UAAkB,EAAE,OAAe,EAAE,YAAoB,EACvD,EAAE,CAAC,CAAC;IACtB,MAAM;IACN,QAAQ,EAAE,IAAI,IAAI,CAAC,UAAU,GAAG,OAAO,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,EAAE;IAC1F,YAAY;CACb,CAAC,CAAC;AAEH,iFAAiF;AACjF,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,KAAuB,EAAE,GAAW,EAAW,EAAE,CAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;AAE1H,6EAA6E;AAC7E,MAAM,CAAC,MAAM,yBAAyB,GAAG,8EAA8E,CAAC;AAexH,wFAAwF;AACxF,MAAM,CAAC,MAAM,yBAAyB,GACpC,0FAA0F,CAAC;AAE7F,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAqB,EAAmB,EAAE,CAAC,CAAC;IAC5E,QAAQ,EAAE,CAAC,CAAC,SAAqB;IACjC,OAAO,EAAE,CAAC,CAAC,QAAmB;IAC9B,SAAS,EAAE,CAAC,CAAC,UAAU;IACvB,MAAM,EAAE,CAAC,CAAC,OAAO;IACjB,KAAK,EAAE,CAAC,CAAC,KAAiC;IAC1C,SAAS,EAAE,CAAC,CAAC,UAAU;IACvB,QAAQ,EAAE,CAAC,CAAC,QAAQ;IACpB,IAAI,EAAE,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;IACrE,UAAU,EAAE,CAAC,CAAC,WAAW;CAC1B,CAAC,CAAC"}

package/dist/scope-host.d.ts

@@ -1,14 +1,17 @@
 import type { ModuleLog } from './module-log.js';
+import type { BoundOperations } from './module-operations.js';
 import type { DeliveryRefusal } from './delivery-refusal.js';
 import type { ScopeRoleHolder } from './scope-role-admin.js';
+import type { ScopeCopyBackfillResult } from './scope-copy-ledger.js';
 import type { SubjectRedactionCounts } from './subject-redaction.js';
-import type { OnBehalfOf, ExportReadInput, ExportedBatch, ImportBatch, ImportedEvent, ImportResult, ImportState, ImportCursorMove, ImportCursorMoved, AdminAction, BecomeCapabilityInput, CapabilityExchange, CapabilityFilter, CapabilityId, CapabilityPage, MintedCapability, ListPage, ConnectLink, ConnectLinkConsume, ConnectLinkFilter, ConnectLinkKey, ConsumeConnectLinkInput, MintConnectLinkInput, Connection, ConnectionFilter, ConnectionId, ConnectionGrant, ConnectionGrantRecord, ConnectionSecret, CreateConnectionInput, OpenConnection, ProjectedConnectionGrant, ProjectedConnectionKey, AccessLogEntry, DelegatedReadRecord, OwnerTransferAudit, MemberChangeAudit, PeerBindingAudit, CopyMarkAudit, BindHostnameInput, AdminLogEntry, OpsFailureEntry, PlatformRequestDrainTotalsEntry, SweepRunEntry, SweepRunKind, SweepRunOutcome, ModelUsageEntry, ModelUsageSummary, CapabilityGrant, CreateTenantInput, Decision, Instant, DomainEvent, DomainEventInput, PlatformRequestInput, PlatformRequestId, PlatformRequest, PlatformRequestFilter, PlatformRequestStatus, PlatformRequestFailure, PlatformOutcomeEvent, EntitlementGrant, EntitlementGrantInput, EntitlementView, MeterReading, EntityRef, IdentityLink, IdentityPool, Jurisdiction, ModuleId, ModuleManifest, ScheduleSpec, SystemGrant, PeerGrantsStatusEntry, SystemGrantsStatusEntry, SystemSwitchRecord, SystemSwitch, SystemSwitchResult, PeerCoverage, PeerSwitch, PeerSwitchResult, VerticalCaller, VerticalResolution, PeerBinding, PeerInstanceResolution, CreateOrgInput, Node, Org, OrgId, OrgMembership, PermissionKey, PlatformActorId, ChannelName, ExportBreak, ChannelHistoryEntry, DnsRecord, HostnameBinding, HostnameStatus, PromotionAcknowledgement, BindAcknowledgement, PublishVersionInput, RegisterVerticalInput, VerticalServingState, RouteTarget, DirectoryDump, IdentityMembership, PrincipalId, ResolvedIdentity, RoleAssignment, RoleDefinition, QueryScopeInput, ReadScopeTableInput, Scope, ScopeDump, SubjectShredReceipt, ScopeQueryResult, ScopeId, ScopeStatus, ScopeTable, DenialFilter, DenialSummary, RefusalFilter, RefusalRecord, PermissionDenial, Coverage, BeginImpersonationInput, ImpersonationFilter, ImpersonationSession, ImpersonationSessionId, ScopeTablePage, StorageShape, Tenant, TenantId, TenantRole, TenantStoreHandle, AttachmentRecord, BlobStoreHandle, Visibility, Vertical, VerticalChannel, VerticalVersion, TenantStatus, Page, CountedPage, FreshnessSpec, EntityHistoryInput, EventFacetInput, EventCauseInput, EventEffectsInput, EffectsTree, InvocationEventsInput, InvocationEvents, DeadLettersInput, DeadLetter, LifecycleFlowInput, LifecycleFlowResult, OperationSeriesInput, OperationSeriesResult, CauseChain, EventFacetResult, HistoryEntry, ErrorCode, PlatformRequestFailureOrigin, IssueEntry, IssueStatus, IssueStatusInput, FindingEntry, FindingFilter, FindingRuleEntry, FindingRuleInput, FindingStatusInput, DeclaredMigration, CheckSubject, EntityGrantShape } from '@substrat-run/contracts';
+import type { OnBehalfOf, ExportReadInput, ExportedBatch, ImportBatch, ImportedEvent, ImportResult, ImportState, ImportCursorMove, ImportCursorMoved, AdminAction, BecomeCapabilityInput, CapabilityExchange, CapabilityFilter, CapabilityId, CapabilityPage, MintedCapability, ListPage, ConnectLink, ConnectLinkConsume, ConnectLinkFilter, ConnectLinkKey, ConsumeConnectLinkInput, MintConnectLinkInput, Connection, ConnectionFilter, ConnectionId, ConnectionGrant, ConnectionGrantRecord, ConnectionSecret, CreateConnectionInput, OpenConnection, ProjectedConnectionGrant, ProjectedConnectionKey, AccessLogEntry, DelegatedReadRecord, OwnerTransferAudit, MemberChangeAudit, PeerBindingAudit, CopyMarkAudit, BindHostnameInput, AdminLogEntry, OpsFailureEntry, PlatformRequestDrainTotalsEntry, SweepRunEntry, SweepRunKind, SweepRunOutcome, ModelUsageEntry, ModelUsageSummary, CapabilityGrant, CreateTenantInput, Decision, Instant, DomainEvent, DomainEventInput, PlatformRequestInput, PlatformRequestId, PlatformRequestEntry, PlatformRequestFilter, PlatformRequestStatus, PlatformRequestFailure, PlatformOutcomeEvent, EntitlementGrant, EntitlementGrantInput, EntitlementView, MeterReading, ScopeStorageSample, EntityRef, IdentityLink, IdentityPool, Jurisdiction, ModuleId, ModuleManifest, ScheduleSpec, SystemGrant, PeerGrantsStatusEntry, SystemGrantsStatusEntry, SystemSwitchRecord, SystemSwitch, SystemSwitchResult, PeerCoverage, PeerSwitch, PeerSwitchResult, VerticalCaller, VerticalResolution, PeerBinding, PeerInstanceResolution, CreateOrgInput, Node, Org, OrgId, OrgMembership, PermissionKey, PlatformActorId, ChannelName, ExportBreak, ChannelHistoryEntry, DnsRecord, HostnameBinding, HostnameStatus, PromotionAcknowledgement, BindAcknowledgement, PublishVersionInput, RegisterVerticalInput, VerticalServingState, RouteTarget, DirectoryDump, IdentityMembership, PrincipalId, ResolvedIdentity, RoleAssignment, RoleDefinition, QueryScopeInput, ReadScopeTableInput, Scope, ScopeDump, SubjectShredReceipt, ScopeQueryResult, ScopeId, ScopeStatus, ScopeTable, DenialFilter, DenialSummary, RefusalFilter, RefusalRecord, PermissionDenial, Coverage, BeginImpersonationInput, ImpersonationFilter, ImpersonationSession, ImpersonationSessionId, ScopeTablePage, StorageShape, Tenant, TenantId, TenantRole, TenantStoreHandle, AttachmentRecord, BlobStoreHandle, Visibility, Vertical, VerticalChannel, VerticalVersion, TenantStatus, Page, CountedPage, FreshnessSpec, EntityHistoryInput, EventFacetInput, EventCauseInput, EventEffectsInput, EffectsTree, InvocationEventsInput, InvocationEvents, DeadLettersInput, DeadLetter, LifecycleFlowInput, LifecycleFlowResult, OperationSeriesInput, OperationSeriesResult, CauseChain, EventFacetResult, HistoryEntry, ErrorCode, PlatformRequestFailureOrigin, IssueEntry, IssueStatus, IssueStatusInput, FindingEntry, FindingFilter, FindingRuleEntry, FindingRuleInput, FindingStatusInput, DeclaredMigration, CheckSubject, EntityGrantShape } from '@substrat-run/contracts';
 import type { ConnectionUseOutcome } from './connector-calls.js';
 import type { CapabilityVerbs } from './capability.js';
 import type { AuditedOperationRef, AuditedOperationRow } from './audit-outcome.js';
 import { type EntityStateName } from '@substrat-run/contracts';
 import type { ModelUsageFilter, ModelUsageInput, ModelUsageWindow } from './model-usage.js';
 import type { FindingPruneReport } from './findings.js';
+import type { ScopeStorageAttempt, ScopeStorageFilter, ScopeStorageReadingInput } from './storage-gauge.js';
 import type { SealedSecret } from './secret-box.js';
 import type { OnSubjectErased } from './module-erasure.js';
 import type { SystemSwitchReassert, SystemSwitchReassertOptions, SystemSwitchRecordFilter } from './system-switch-record.js';
@@ -184,8 +187,14 @@ export interface OperationContext {
      *
      * Read-only by construction: the kernel owns every write to this table (rule 3 forbids module
      * code writing `_substrat_*`), so an intent's status is only ever the platform's answer.
+     *
+     * **A row whose identity does not decode comes back as an `UndecodablePlatformRequest`**
+     * (#1637) — its id, kind, status, attempts or time as stored, and why — beside every other row,
+     * instead of throwing for the whole list. Narrow with `isUndecodablePlatformRequest` before
+     * reading anything else. Only a restored dump can hold such a row; a healthy journal never
+     * returns one.
      */
-    platformRequests(filter?: PlatformRequestFilter): PlatformRequest[];
+    platformRequests(filter?: PlatformRequestFilter): PlatformRequestEntry[];
     /**
      * This entity's version (#901) — the ULID of the last event about it, or
      * `null` if nothing has ever been emitted about it.
@@ -665,7 +674,7 @@ export interface InvokeOptions {
      * call. That is the join a trace view needs and the one nothing could make: the
      * runtime's own request id is stamped by the log platform at ingestion, so no
      * vertical code can read it, and a trace does not cross the dispatch hop
-     * (`invocation-log.ts`, verified in production).
+     * (vertical-host's `invocation-log.ts`, verified in production).
      *
      * So the platform mints one, puts it in the invocation log line, and carries it
      * here — where it is stamped onto every event the call emits. That makes an
@@ -1503,86 +1512,28 @@ export declare function consumersFor<const C extends readonly EventContract[]>()
 export interface ModuleRegistration<C extends readonly EventContract[] = []> {
     manifest: ModuleManifest;
     migrations?: SqlMigration[];
-    operations?: Record<string, OperationHandler<never, unknown>>;
-    /**
-     * name → the schema the host parses an invocation's input against, BEFORE the
-     * guards and the handler see it (#893).
-     *
-     * Derived from the declared operation surface — `operationInputsOf(ops)` — and
-     * never written a second time. A module that declares its operations gets the
-     * parse by handing the same object over:
-     *
-     * ```ts
-     * operations: { 'rally/book': bookOp, … },
-     * operationInputs: operationInputsOf(rallyOperations),
-     * ```
-     *
-     * **This is where "parse, don't trust" is kept, rather than in 85 handlers.**
-     * `OperationShape.input` calls itself *"the SAME Zod object the handler
-     * parses"* and across the fleet it mostly was not — rally declared 32 inputs
-     * and parsed 2. One place that cannot be forgotten beats a rule every new
-     * operation has to remember, which is the same argument `mountOperations`
-     * already makes for the page trio.
-     *
-     * A name here that no operation binds is an error: it is a schema enforcing
-     * nothing, and it reads as coverage. A bound operation with no entry is
-     * allowed and means what it always meant — nothing was declared to parse.
-     *
-     * **It also carries the declared surface (#119).** `operationInputsOf` records, for the frozen
-     * map it returns, every declared operation and the entity each addresses by id. The host DERIVES
-     * its trash refusal from that — nothing else is handed over — and a module with a trashable
-     * entity must pass that map as returned, with every operation it binds declared in it.
-     *
-     * Typed structurally rather than as `z.ZodType` so the kernel keeps its single
-     * dependency and no zod version is pinned by the scope-host contract. The
-     * shape is the whole surface the host uses: throw to refuse, return the value
-     * to accept.
-     */
-    operationInputs?: Record<string, {
-        parse(value: unknown): unknown;
-    }>;
     /**
-     * name → the entity whose version this operation's `If-Match` is compared
-     * against, and the input field carrying its id (#129).
-     *
-     * Derived from the declared operation surface — `operationConcurrencyOf(ops)` —
-     * and never written a second time, exactly as `operationInputs` is:
+     * The module's operations: its handlers and, derived from their declaration, the input schemas
+     * the host parses with, the `If-Match` concurrency map and the idempotency opt-outs (#1835).
+     * From `operationsFor(declaration)(handlers)` or, for a module with no declared surface,
+     * `undeclaredOperations(reason, handlers)` — never an object literal:
      *
      * ```ts
-     * operations: { 'callout/update-customer': updateCustomerOp, … },
-     * operationInputs: operationInputsOf(calloutOperations),
-     * operationConcurrency: operationConcurrencyOf(calloutOperations),
+     * ...operationsFor(rallyOperations)({ 'rally/book': bookOp, … }),
      * ```
      *
-     * **The host compares, not the handler.** A precondition a handler evaluates is
-     * a precondition a handler can forget, and the one that is forgotten is
-     * indistinguishable from one that passed. Here the comparison happens between
-     * `BEGIN` and the guards for every caller and every transport, or the operation
-     * does not claim to have it.
+     * **This is where "parse, don't trust" is kept, rather than in 85 handlers** (#893).
+     * `OperationShape.input` calls itself *"the SAME Zod object the handler parses"* and across
+     * the fleet it mostly was not — rally declared 32 inputs and parsed 2. The schemas, the
+     * concurrency the host compares between `BEGIN` and the guards (#129) and the opt-outs (#116)
+     * used to be three more optional fields beside the handlers, so a module could hand over the
+     * handlers and forget the rest, or pair them with another declaration's. One value closes both.
      *
-     * A name here that no operation binds is an error, for the same reason it is on
-     * `operationInputs`: it reads as coverage while enforcing nothing.
+     * A schema or a concurrency entry naming no bound operation is an error: it enforces nothing
+     * and reads as coverage. The inputs also carry the declared surface (#119) the host derives
+     * its trash refusal from, so a module with a trashable entity must bind through `operationsFor`.
      */
-    operationConcurrency?: Record<string, {
-        entity: string;
-        idFrom: string;
-    }>;
-    /**
-     * The operations that declared `idempotency: false` (#116) — the ones whose
-     * response must not be recorded, and which therefore refuse an
-     * `Idempotency-Key` instead of honouring it.
-     *
-     * Derived like the two above, and never written a second time:
-     *
-     * ```ts
-     * operationIdempotencyOptOuts: operationIdempotencyOptOutsOf(calloutOperations),
-     * ```
-     *
-     * A list of refusals rather than a list of participants, because that is what
-     * the declaration is. Absent means every operation honours a key, which is the
-     * default and the reason there is nothing to remember.
-     */
-    operationIdempotencyOptOuts?: readonly string[];
+    operations?: BoundOperations;
     /**
      * eventType → handler; the types must appear in manifest.events.consumes.
      *
@@ -1719,11 +1670,20 @@ export interface HostAdmin {
      * something was fully shared with as a holder.
      *
      * Bounded: `batch` rows of work (default 500, an integer from 1 to 5000, or `validation_failed`)
-     * per scope transaction, backfill included, repeated until a pass finishes — so it is safe
-     * on a large scope, and finishes on a re-run if interrupted. Each (person, entity) topped up is
+     * per scope transaction, backfill included, and at most ten markers read per row of work, read
+     * on their own index (#2083). Each pass resumes where the last one stopped, until one finds
+     * nothing left, so it is safe on a large scope whether or not anything changed, and finishes on
+     * a re-run if interrupted. A holder an older deployment grants the shape to while it runs, behind
+     * the point it has reached: if they lack a key the shape gained, the next reconcile tops them up.
+     * If they hold a key the shape retired, a confirming walk from the first marker, which every
+     * retirement runs before it records itself finished, takes it back. Only a grant landing behind
+     * that confirming walk keeps the key, as one landing after the retirement finished does. Each (person, entity) topped up is
      * an `entity.grants-topped-up` event on the entity, and each one retired keys were taken from an
      * `entity.grants-retired` event. Audited as `reconcileEntityGrantShapes` when it changed
-     * anything. Returns how many (person, entity) it topped up, and how many it retired keys from.
+     * anything. Returns how many (person, entity) it topped up, and how many it retired keys from;
+     * plus, only when nonzero, `retirementsLeftOpen`: shapes whose retirement kept meeting new
+     * grants of a retired key (`SHAPE_RETIRE_CONFIRMS_MAX` confirming walks that took keys) and was
+     * left for the next reconcile to run again, unrecorded.
      */
     reconcileEntityGrantShapes(actor: PlatformActorId, node: {
         tenantId: TenantId;
@@ -1733,6 +1693,7 @@ export interface HostAdmin {
     }): Promise<{
         toppedUp: number;
         retired: number;
+        retirementsLeftOpen?: number;
     }>;
     /** Grant to an organization (portal customers); members reach it via membership tuples. */
     /**
@@ -1952,14 +1913,13 @@ export interface HostAdmin {
     }): Promise<PeerGrantsStatusEntry[]>;
     /**
      * Mint a `become` capability on a scope (#1672): whoever exchanges its secret yields
-     * `input.principal` rather than a session — the shape an owner claim link and a member
-     * invite are, so both can move onto this primitive later. The secret is returned once;
-     * the scope keeps its hash. Expiry and a use limit are required.
+     * `input.principal` rather than a session — the shape an owner claim link is. The secret is
+     * returned once; the scope keeps its hash. Expiry and a use limit are required.
      *
-     * Platform-only in this first cut, deliberately: `become` is impersonation by another
-     * name, and the bound on who may mint one from module code is designed with the claim
-     * and invite migrations. Audited in the admin log (never the secret, never its hash).
-     * Refuses an unknown or inactive scope, as `getScope` does.
+     * `become` is impersonation by another name, so module code never mints one. This is the
+     * platform's mint; a principal mints one only through an adapter's bounded host verb (a
+     * member invite, `becomeMintCheck`, #1686). Audited in the admin log (never the secret, never
+     * its hash). Refuses an unknown or inactive scope, as `getScope` does.
      */
     mintCapability(actor: PlatformActorId, tenantId: TenantId, scopeId: ScopeId, input: BecomeCapabilityInput): Promise<MintedCapability>;
     /**
@@ -2338,6 +2298,19 @@ export interface HostAdmin {
     opts?: {
         claimedBy?: string;
     }): Promise<boolean>;
+    /**
+     * Record a copy made before this ledger existed (#1722's backfill) as `retained`: reached by reap
+     * and erasure, never wiped by the sweep. One entry per (scope, script), under `BACKFILL_MOVE_ID`.
+     * Answers `ledgered`, writing nothing, when the ledger already names the script for the scope in
+     * any state; `reaping` under a reap claim; `missing` for an unknown scope. Never throws for those,
+     * so a backfill page reports each one instead of stopping. A recorded entry is audited as
+     * `backfillScopeCopy`.
+     */
+    backfillScopeScriptCopy(actor: PlatformActorId, tenantId: TenantId, scopeId: ScopeId, scriptRef: string, 
+    /** The admin-log row the script was read from, named in the `backfillScopeCopy` row a recorded entry writes. */
+    opts?: {
+        fromLogId?: string;
+    }): Promise<ScopeCopyBackfillResult>;
     /** Move a failed retry to the back of the due queue without changing its state. */
     touchScopeScriptCopy(actor: PlatformActorId, tenantId: TenantId, scopeId: ScopeId, scriptRef: string, moveId: string): Promise<void>;
     listScopeScriptCopies(actor: PlatformActorId, filter: {
@@ -2890,7 +2863,12 @@ export interface HostAdmin {
     suspendScope(actor: PlatformActorId, tenantId: TenantId, scopeId: ScopeId): Promise<void>;
     /** suspended → active. */
     unsuspendScope(actor: PlatformActorId, tenantId: TenantId, scopeId: ScopeId): Promise<void>;
-    /** active|suspended → archived. Stops the active-scope meter (§9). */
+    /**
+     * provisioning|active|suspended → archived. Stops the active-scope meter (§9). A status
+     * change only: the storage stays until `reapScope`. Records the status it left as
+     * `archivedFromStatus` (#1524), so a scope abandoned while still provisioning, which never
+     * held data, is not metered for storage.
+     */
     archiveScope(actor: PlatformActorId, tenantId: TenantId, scopeId: ScopeId): Promise<void>;
     /**
      * archived → active. A RESTORE, never a flag flip (control-plane.md §4.2):
@@ -3367,6 +3345,33 @@ export interface HostAdmin {
      * to `null`.
      */
     pruneTelemetry?(actor: PlatformActorId, limit: number): Promise<TelemetryPruneReport>;
+    /**
+     * The stored storage gauge (#1524): record the scheduled pass's attempts to read scope
+     * database sizes. Each attempt replaces the scope's attempt row (what the pass picks due
+     * scopes by); a successful one also writes the day's sample, one row per (scope, UTC day),
+     * a later same-day reading replacing an earlier one. A failed one leaves the last sample
+     * standing. Rows are written only for a stored (not provisioning, not reaped) scope the directory holds under the named
+     * tenant. Returns how many SAMPLE rows were written. Not audited, like `recordSweepRun`:
+     * retention-bounded telemetry, not evidence.
+     *
+     * The gauge methods are optional, and the sweep's storage phase is skipped on a host that
+     * lacks them, so an adapter built before #1524 still satisfies `HostAdmin`.
+     */
+    recordScopeStorage?(actor: PlatformActorId, readings: readonly ScopeStorageReadingInput[]): Promise<{
+        recorded: number;
+    }>;
+    /**
+     * Stored storage samples (#1524) — the latest per scope, or a bounded history. See
+     * `ScopeStorageFilter`. A directory read that wakes no scope. Access-logged (K-24).
+     */
+    listScopeStorage?(actor: PlatformActorId, filter?: ScopeStorageFilter): Promise<ScopeStorageSample[]>;
+    /** Every stored scope's latest storage-read attempt (#1524): the storage phase's due list. Access-logged. */
+    listScopeStorageAttempts?(actor: PlatformActorId): Promise<ScopeStorageAttempt[]>;
+    /**
+     * Delete storage samples past `STORAGE_GAUGE_RETENTION_MONTHS`, oldest first and at most
+     * `limit` per call, so a backlog drains over passes. Returns how many went. Not audited.
+     */
+    pruneScopeStorage?(actor: PlatformActorId, limit: number): Promise<number>;
     /**
      * A staff verdict on one issue (#1233): resolve, ignore, or reopen. `regressed`
      * is ingest's word and not accepted here. Returns the updated row, or undefined
@@ -4875,8 +4880,11 @@ export interface ScopeHost {
      * `ctx.requestPlatform` awaiting the platform's drain. Fleet maintenance, no actor (the same
      * class as `drainDue`). The platform reads these, executes each with `HostAdmin` authority, and
      * journals the outcome via `settlePlatformRequest` — the read-here/effect-there executor shape.
+     *
+     * A row whose identity does not decode is returned as an `UndecodablePlatformRequest` (#1637),
+     * never thrown for the queue; the drain runs no handler on one.
      */
-    listPlatformRequests(tenantId: TenantId, scopeId: ScopeId): Promise<PlatformRequest[]>;
+    listPlatformRequests(tenantId: TenantId, scopeId: ScopeId): Promise<PlatformRequestEntry[]>;
     /**
      * The scope's intent JOURNAL — every intent in whatever state it settled, newest first (#618).
      *
@@ -4887,9 +4895,11 @@ export interface ScopeHost {
      * SQL. This is the read that surfaces it: `kind` narrows to one intent family
      * (`connector:scrive`), `status` to one outcome, `limit` to a recency window.
      *
-     * Fleet maintenance, no actor — same class as the pending read it complements.
+     * Fleet maintenance, no actor — same class as the pending read it complements. Returns an
+     * `UndecodablePlatformRequest` for a row whose identity does not decode (#1637), as the
+     * pending read does.
      */
-    listPlatformRequestHistory(tenantId: TenantId, scopeId: ScopeId, filter?: PlatformRequestFilter): Promise<PlatformRequest[]>;
+    listPlatformRequestHistory(tenantId: TenantId, scopeId: ScopeId, filter?: PlatformRequestFilter): Promise<PlatformRequestEntry[]>;
     /**
      * Journal a platform-request outcome after the coordinator ran it: `done`, `failed` (terminal),
      * or `pending` (transient — retried on a later drain). `result` persists across retries (a
@@ -5043,26 +5053,6 @@ export interface LiveReadSurface<Req extends LiveUpgradeRequest = LiveUpgradeReq
         expiresAt?: string;
     }): Promise<Res>;
 }
-/**
- * The close codes a live socket ends with, so a client can tell "try again" from "poll".
- *
- * - `1008` (policy): the subscriber may no longer watch what it subscribed to — a
- *   `checkedWithin` gate refused, or the session that opened it ended. A reconnect meets
- *   the handshake's own refusal.
- * - `4429`: this principal already holds `LIVE_SOCKETS_PER_PRINCIPAL` sockets on the scope.
- *   Not a reason to retry: the client should poll, which it does anyway, and stop asking.
- */
-export declare const LIVE_CLOSE: {
-    readonly revoked: 1008;
-    readonly tooMany: 4429;
-};
-/**
- * How many live sockets one principal may hold on one scope (#938). A tab holds one per
- * feed (the desk's, and one per open conversation in ticket0's portal), and each socket is
- * work on every post-commit pass, so a principal opening more is a cost on everybody else
- * writing to the scope. Eight covers several tabs; past it a socket is closed `4429`.
- */
-export declare const LIVE_SOCKETS_PER_PRINCIPAL = 8;
 /** The brand only `vouchedWithin` can apply — a literal cannot type-check as one. */
 declare const vouchedBrand: unique symbol;
 /**